Re:Ask HN: Developer abused “sign in with GitHub”?
by vintermann on Friday December 09, 2022 @08:17AM
(#33920890)
You don't need RARs to limit access. It's just a proposal to standardize very fine-grained control access.
This is not very fine-grained. It would be perfectly possible to gate access to social features of github (such as starring) behind a plain old scope. Distinguishing "access to all your own repositories" from "access to anything else on github, as you" also is not a fine-grained difference.
Re:Ask HN: Developer abused “sign in with GitHub”?
by 9wzYQbTYsAIc on Friday December 09, 2022 @08:38AM
(#33921071)
Sure, but the extra “location” and “action” objects within the proposed “authorization_details” JSON object do seem compelling when compared to just a single “scope” string.
Re:Ask HN: Developer abused “sign in with GitHub”?
by BlueTemplar on Friday December 09, 2022 @08:28AM
(#33920983)
Speaking of shoehorning things, it doesn't look particularly "Open" to me that website owners are free to pick a limited number of authenticating authorities, instead of letting the user to pick their own.
(Imagine if e-mail adresses were considered "invalid" in forms if not from Gmail or Outlook !)
It was especially bad with last years Advent of Code, where going through OpenID (or was it OAuth ?) was the ONLY way to join, and with only 3 options listed, none of which I wanted to use !
That was probably one of the advantages of shoe-horning authentication (OpenID) with the existing authorization standard (OAuth).
> Why is everyone linking this draft? It's got very little to do with what we're discussing.
> … Github ALSO uses OAuth2 to delegate permissions to the user's stuff on their own site
> … But even that should only have access to the user’s own repositories.
Seems like Rich Authorization Requests are exactly what we are discussing.
Give it a skim (or a read).